Common Sense in EDI Security

Image

What happens when an ATM needs to be filled with brand new $20 bills? Let’s examine the whole process:

1. The $20 bills are initially stored in a bank vault. Very secure.
2. An armored truck drives through a tunnel to the bank facility, where armed, trained, and white-listed employees transfer the money from the vault to the armored truck. Again, very secure.
3. Now full of money, the armored truck drives to the ATM location using the most efficient route. At least two armed guards are in the truck protecting the money. Very secure.
4. Upon arrival at the ATM, the armored truck parks as close to the machine as possible. The armed guards carry the locked cartridges full of money from the truck to the ATM as fast as possible, guns at the ready. Don’t mess with them.
5. A guard unlocks the ATM and replaces the empty cartridges with full ones, while another guard keeps watch. Pretty secure.
6. The $20 bills now sit in a locked ATM. Pretty secure.

Now, consider the following hypothetical scenario:

1. The bank leaves the cartridges full of money on the sidewalk, waiting for the armored truck to pick them up.
2. The armored truck is replaced with a typical family sedan.
3. The armed guards are replaced with inexperienced teenagers.
4. The family sedan is parked far away from the ATM location.
5. The ATM is made out of cardboard.

Looking at these examples, we can see that security is a process, a chain of events; for security measures to succeed, every link in the chain of events must be as secure as possible. Now let’s take a look at the transmission of files using Electronic Data Interchange (EDI). The sender of the files may use the secure AS2 protocol, further protect the information being transferred with payload encryption and a digital signature, and transmit the entire message over HTTPS. But are the other links in the security chain as secure as the data the sender has transmitted? Personally, if I was a criminal and I wanted to illegally view information being sent via EDI, I would try to gain access to the sender’s infrastructure, the receiver’s infrastructure, or the Value Added Network (VAN) infrastructure if available. Any one of these methods requires less effort than getting dressed up like an employee from the telephone company and snooping on a fiber-optic cable high up on a telephone post. The fundamental problem with EDI security is that once you send EDI documents to a trading partner, you cannot control what your trading partner will do with that data. Nor do you control any of the other points along the chain of transmission - you only control what is going on in your own organization. The best way to ensure the security of your data (in addition to transmitting your EDI files with the latest technology that encrypts your data four times during transmission) is to identify the easiest way somebody could illicitly access your data and take steps to protect yourself against such an attack. Keep in mind that even if an attacker doesn’t have the precise objective of accessing your data, your data could still be at risk if your trading partner, or any other party in the chain of transmission, is attacked for any reason. Here are some fundamental questions to ask yourself to help you evaluate your risk:

1. Would it harm my company or my trading partners if somebody read my EDI documents?
2. Do I control each link in the security chain inside my organization, i.e. from the workstation used to access the ERP to the router connected to the internet?
3. Once data is sent out of my building, where does my document go? Directly to my trading partners? Through a VAN? Through multiple intermediaries?
4. Once the document reaches its final destination, how is it handled? It may pass through many security links in a trading partner’s organization – a situation that could raise many additional questions.

Image

About the Author: Alain Brousseau is an operation architect at Intertrade EDI Solutions. He has been working in the EDI universe since 2005. Alain has been a regular speaker across Canada and the United States on EDI challenges and optimization. At InterTrade, his passion for continuous improvement and total quality management has led him to design efficient operational architectures. He is a strong advocate of conceptual simplicity and his tool of choice is a white board. He excels at explaining complex technical concepts to both tech-savvy and business people alike. When his brain needs relaxation, you can find him in the wilderness somewhere on his Enduro bike. Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.